Trust and permissions
Trust is how far your peer trusts another person. Every script runs with the trust level of whoever authored its document, and that level decides which host APIs it may call.
Trust is local. Each peer keeps its own table keyed by DID (decentralized identifier), stored on the device and never shared. Two peers can trust the same author differently, and neither is wrong.
Levels
Each level keeps everything the level below it has.
| Level | Who | Adds |
|---|---|---|
| Blocked | People you have blocked | Nothing. They are disconnected, and their changes are undone. |
| Anonymous | Peers that haven't proven a DID | Reading the scene, writing its own documents, messaging, input aimed at its own prims, seeing who owns a document |
| Guest | Any DID you haven't judged | Creating documents, opening portals |
| Trusted | People you have marked as trusted | Durable writes, reading your identity and your body's pose |
| Myself | You | Every input device, physics, storage, travel |
A stranger's ball, door, or whiteboard works at Guest with no prompt. The levels only gate what a stranger's object should never do unasked, like reading who you are or where your body is.
Myself is never stored in the table, so it can't be granted to anyone else by mistake.
A peer can also change its default level for people it hasn't judged. Setting it to Anonymous means a blocked person can't come straight back under a new DID.
A missing permission fails with error.permission.
Permissions are checked when a resource is created, so a handle a script already has keeps working if trust changes.
Shared writes from other people
Every peer in a space writes its shared state into its own session layer on the document, and your peer decides what each layer may change.
The author's layer can set any property.
Anyone else's can set properties in the state group, which only scripts read, and can pair a portal if their level lets them open portals.
A blocked person's layer changes nothing.
This is what stops a visitor from giving your home a new script.
A session property is applied exactly like an authored one, so letting anyone set script would run their code with your home's permissions.
Writes that a layer isn't allowed to make are kept but have no effect.
When the person leaves, your peer takes over what they stated if their level is Guest or above, and lets it go otherwise.
Limits
Trust also scales how much a peer may use. There are two kinds of limit.
- A rate limits how fast a script may act, such as creating prims or sending messages.
Running out fails with
rate-limited, and the rate refills over time. - A ceiling caps the resources a script has at once, such as documents, prims, or memory.
Running out fails with
limit-reached, until the script frees some.
Each peer gets a share of the per-peer budget based on its trust.
| Level | Share |
|---|---|
| Blocked | 0% |
| Anonymous | 5% |
| Guest | 25% |
| Trusted | 100% |
| Myself | 400% |
A guest's object still gets a usable budget. A spam script hits its limit before anyone notices, and a trusted friend never does. Your own scripts get the largest budget, but it is still finite, so a runaway script of yours can't take the whole machine.
A person pays for their own shared writes, out of their own budget, even when they write to your document.